gina 0.6.27 → 0.6.28

package/CHANGELOG.md

@@ -6,6 +6,29 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html),
 and is generated by [Changie](https://github.com/miniscruff/changie).
 
 
+## 0.6.28 - 2026-09-06
+### Added
+* `self.forward()` now relays a `multipart/form-data` request as multipart, uploads included. It handed `req[method]` to `self.query()`, which JSON-encodes its `data` and forces the outbound content-type to the json mime, so a forwarded upload reached the target as a JSON object of its text fields and `req.files` never travelled at all. A new `lib/multipart` encoder rebuilds one RFC 7578 body from the parsed text fields — re-flattened to bracket notation, the exact inverse of the parser's nester — and from the staged files read at their staged paths, under a CSPRNG boundary re-drawn until it occurs in no part; that body travels through `query()`'s new `options.body` raw-body pass-through, so the caller's own content-type survives on both transports and the HTTP/2 request prep no longer relabels it with the incoming request's boundary. The body is buffered and therefore bounded: by the source bundle's `upload.maxFieldsSize` when the parser stamped a usable cap, else by a 16 MB default, checked against the field bytes plus the on-disk sizes before a single byte is read — a breach answers 413 naming both numbers. Files forwarded under a method that carries no body answer 400, an unreadable staged part answers 500 naming the path, and staged files are read but never deleted, so the source's own cleanup still owns them. Server-side only; pickup is a bundle restart. (#B489)
+### Fixed
+* A child template that names its layout somewhere ahead of its `{% extends %}` directive — in a leading comment, for instance — no longer loses the layout-cache re-point. The rewrite that sends the directive at its assembled cache copy searched the whole template for the layout's bare filename and took the first occurrence anywhere, so the comment was rewritten while the directive kept the raw path and the page went on extending the un-assembled layout. The substitution is now spliced inside the matched directive, so a later legitimate mention of the same filename in the child is left untouched. (#B482)
+* The `{% extends %}` extraction no longer overruns its own directive. Both quantifiers were greedy, so a one-line directive followed by another quoted tag ran the directive match to the last closing delimiter on the line and the quoted-path match to the last quote, producing a corrupted layout path that matched nothing — the layout-cache re-point then silently never happened and the page extended the raw layout. Both quantifiers are lazy, so the extraction stops at the directive it came from. (#B484)
+* `self.store()` no longer drops the outcome of a `null` callback. The fluent guard tested only for `undefined`, so `store(target, files, null)` — or any non-function — fell into the callback branch of the inner `start()`, whose seven `if (cb) … else emit` arms then emitted to an event with zero in-tree listeners: the upload ran and nothing was told, and a truthy non-function given to `.onComplete()` threw a `TypeError` from inside an fs callback, an uncaughtException on every path but the synchronous empty-upload one. The guard now mints the fluent handle for any non-function `cb`, mirroring `query()`, `.onComplete()` throws a `TypeError` synchronously at the caller when given a non-function, and the seven unreachable emitter arms are removed together with their undocumented event. Behaviour change: `store(target, files, null)` returns the handle and starts the upload when `.onComplete()` is chained, exactly like an omitted `cb` — it no longer starts an upload whose result is lost. Server-side only; pickup is a bundle restart. (#B480)
+* The client no longer stays half-booted on a light page. `core.js` attached its `ginaloaded` listener only after the async `routing.json` fetch resolved, while the `core` RequireJS factory — which the loader defers by a 4 ms `nextTick` — is what constructs gina and dispatches the event: whenever the fetch lost that 4 ms race the event fired with no listener, the whispered `onGinaLoaded` loader was never invoked against the constructed instance, `isFrameworkLoaded` never flipped, and the popin, validator and nav boot pollers gave up — every `data-gina-nav` hop degraded to a full navigation and no form ever bound. A page registering a `gina.ready()` handler had a second route to the loader through the ready scheduler, which is why heavier pages booted; a page without one had only the listener. The listener is now attached at parse time, above the `core` module definition, and resolves the loader lazily at dispatch (the server-whispered `onGinaLoaded`, or the built-in fallback), so it precedes the dispatch by construction; the #B414 gate-release order is byte-identical. Browser-bundled: pickup is a bundle restart and a re-bake. (#B483)
+* `self.forward()` now forwards to the route it resolves. It used to compute the target route and discard it, sending the request to the target bundle's webroot alone — or, for a raw host, to the port number as the path — with placeholder values taken from the routing declaration (`":id"`) instead of the captured URL parameters, an inverted `project` override, and a credentials read that could throw on a bundle without any. The resolved route url is now the forwarded path, placeholder values come from the request, a string answer is relayed verbatim with `renderTEXT()` instead of being re-encoded as JSON, and an unknown target is answered through `throwError()`. `multipart/form-data` bodies are still not relayed. (#B488)
+* The Inspector View tab shows the http/2 preload assets map again. Since 0.6.25 it rendered the literal `${assets}`: the layout-level substitution that used to swap the placeholder for the real `getAssets()` map stopped matching once inline-script brace escaping landed (#B463), and 0.6.27 then moved the Inspector payload after template execution (#B464), so the placeholder object rode `user.view.assets` — and the XHR hidden view input — verbatim for three releases. The payload now reads the per-template parsed assets map at splice time on both cache paths, the placeholder and the dead substitution are retired (#B481), and under http/1.1 — where the http/2 preload block never runs — `view.assets` is simply absent instead of a placeholder. Server-side only; pickup is a bundle restart. (#B490, #B481)
+* `self.query()`'s fluent `.onComplete()` now rejects a non-function at registration. It minted a deliverer for whatever it was given, so `.onComplete(null)` or `.onComplete('oops')` registered silently and the `TypeError` only fired at settle — inside the delivery wrapper's own try/catch, which turned it into a 500 "Controller Query Exception while catching back" that blamed the application callback for an exception it never had. `.onComplete()` now throws a `TypeError` synchronously at the caller's line when given a non-function, mirroring `self.store()` (#B480); the minting guard on the call argument is unchanged, so `query(options, data, null)` still returns the handle. Behaviour change: a non-function registration fails at the caller instead of at settle — anything relying on the old behaviour was relying on a 500. Server-side only; pickup is a bundle restart. (#B485)
+* The client boots inside a cross-origin iframe. `construct()` read `parent.window['gina']` unconditionally to inherit a parent frame's instance; under a cross-origin parent that named-property read throws `SecurityError`, and because `construct()` is `async` the throw became an unobserved rejection — `ginaloaded` was never dispatched and the page stayed silently half-booted, with nothing in the console beyond the rejection. The inheritance is optional and is now attempted inside a try/catch: a same-origin parent still shares its instance, a cross-origin one is skipped and the boot proceeds. Measured before and after in a two-origin browser repro. Browser-bundled: pickup is a bundle restart and a re-bake. (#B486)
+* A retried HTTP/1 request no longer goes out without its body. The handler deleted `options.queryData` after writing the first attempt and the retry re-entered with the same options object, so the second attempt was sent with `content-length: 0` and an empty body, and whatever the upstream made of that was reported back as the result. It affected any body, but only with `retryUnsafe` enabled, since the methods that auto-retry by default carry none. The body is now stashed on the options the way the HTTP/2 handler already stashed it, and restored on re-entry. Server-side only; pickup is a bundle restart. (#B494)
+* The http/2 `link` preload header is sent on every response again, not only on the first one per view. With `server.cache.enable: true` a bundle served over HTTP/2 built its `rel=preload` header on the compile path only, and the compiled-template cache-hit path returned before reaching it — so in production the first request of a view carried the hints and every later request carried none, with no 103 Early Hints to compensate. The header is now assembled once per view and memoised on the compiled-template cache entry, and a cache hit re-emits it under the same gates (never for an XHR request, never in dev). Two consequences worth knowing: when the template cache is on, an XHR request now computes the preload map too — the entry is shared with every later render of the view, so a page first loaded by fetch no longer leaves it empty — and an empty `link` header is no longer sent when nothing qualifies. The Inspector's `view.assets` map, restored for the compile path by #B490 earlier in this release, now reaches cache hits as well: the router clones options per request, so the map a compile left behind had died with that request. Server-side only; pickup is a bundle restart. (#B495, #B490)
+* The automatic 103 Early Hints response now fires. `render()` read the accumulated `h2Links` preload prefix and called `setEarlyHints()` when it was truthy, but the only writers of that prefix are the two `+=` sites in `getNodeRes()`, reached from `setResources()`, which every one of the five render delegates calls *after* `render()` has dispatched to it — so the read always saw the empty string the router seeds, and the hint was skipped on every request since the feature was added (it was never a regression: the introducing commit already dispatched below the read). The prefix is now computed in `render()` before the dispatch, from the view's declared stylesheets and scripts, and the router's seed is restored immediately afterwards so the delegate rebuilds the final 200 `Link` header from clean — that header is byte-identical, verified on a live HTTP/2 production boot alongside a same-boot control. The computation sits after the content-negotiation block, because that is what resolves whether the request is a fragment, and the delegates filter their asset list to common-only for fragments; it resolves its view config the way all five delegates do, so a custom-error render hints the error page's assets. No hint is sent for XHR requests, in dev, or for assets using Subresource Integrity (a preload hint carries no integrity metadata). `self.setEarlyHints()` was unaffected and has always worked. Server-side only; pickup is a bundle restart. (#B496)
+* `POST /_gina/maintenance` no longer fails open on an invalid `ttlSeconds`. The handler validated `enable` but guarded `ttlSeconds` with a single positive condition, so a present value that was not an integer from 1 to 86400 — a 25-hour window, a float, a numeric string — was silently ignored and the flip applied with no timer at all: the caller asked for a bounded maintenance window and got an unbounded one, with `until: null` in the response as the only tell. Both engines now refuse such a value with 400, naming the bound and the configuration alternative for a window that must outlive a day or a restart, and leave the runtime state untouched; an absent or `null` `ttlSeconds` still means no timer. Refused rather than clamped on purpose: a shorter-than-requested maintenance window reopens a site mid-deploy, so unlike the instrumentation window there is no safe direction to round toward. Behaviour change, disclosed: a caller that was sending an invalid `ttlSeconds` and reading 200 now reads 400 — every such caller was already getting an outcome it had not asked for. Server-side only; pickup is a bundle restart. (#B498)
+* A custom error page rendered over HTTP/2 now carries the config-declared CSS/JS `rel=preload` entries in its final `link` header, and — when scripts are not in defer mode (`javascriptsDeferEnabled: false`, the only mode in which the framework injects external plugins into the head) — its head carries the scripts declared with `isExternalPlugin: true`, like every other page. The custom-error render built its options with a copy of the template config, so what the framework accumulated for the error page while resolving its assets never reached the header and the head the render read — error pages had never carried either since both existed. The custom-error render now shares the request's template object and re-seeds `h2Links` and `externalPlugins` first, so an error struck after the failing route's assets were already resolved (a template compilation error) does not double the preload entries or the plugin tags. Pickup is a bundle restart. (#B497)
+* The `run()` helper (the framework global, also `gna.run`) now throws a `TypeError` at the caller's line when its fluent `.onComplete()` or its positional callback is given anything but a function — `run — onComplete expects a function, got string`. A wrong argument used to be accepted silently: the command ran to completion, the resulting `callback is not a function` was caught by the command's close handler and only logged, and the caller's completion never arrived. `null`/`undefined` as the positional callback still mean "use `.onComplete()`"; `.onData()` already failed fast through Node's own listener check and is unchanged. (#B491)
+* Shell::run() (the `lib/shell` helper) now throws a `TypeError` at the caller's line when its fluent `.onComplete()` or `.onData()` handle is given anything but a function — `Shell::run — onComplete expects a function, got string`. Both handles wrap the callback inside their own listener, so a wrong argument used to be accepted silently: the command ran to completion, the resulting `callback is not a function` was caught by the close handler's try/catch and only logged through the framework logger, and the caller's delivery never arrived. `null` is reported as `null` rather than `object`. This is the same guard `run()` gained for its own callbacks; unlike `run()`, whose `.onData()` hands the callback straight to the emitter and so already failed fast, both of Shell's handles needed it. (#B491)
+* The empty `onComplete` that was attached to every entity METHOD object has been removed. It was a leftover of the pre-Promise design, when a method returned the entity function itself with the handle hanging off it; since methods began returning a native Promise the supported form has been `entity.method(args).onComplete(cb)`, whose handle lives on the returned promise. Its own comment claimed it would be overridden by that code, which never happened — nothing wrote to it, so a callback registered on the method rather than on the call was swallowed and never fired. Disclosed behaviour change: `entity.method.onComplete(cb)` — the wrong form, and silently dead in every release that had it — now throws `is not a function` at the call site instead of going quiet. The correct `entity.method(args).onComplete(cb)` is untouched. (#B491)
+### Security
+* Absolute URLs built by an application-level `getRoute().toUrl()` no longer inherit another request's proxy context. After one request carrying a port-less `Host` (an orchestrator probe, a sibling-bundle call, any client sending `Host: name` with no port) had reached a worker, every later direct request on that worker built its URLs from a worker-global: on an http/1.1 bundle the port vanished, and on an http/2 + https bundle the last port-less client's host was emitted verbatim — a host the client chooses, so a host-header-injection class for application-built links and redirects. `getRoute()` now resolves the proxied classification and proxy hostname from the request itself, through a per-request store the server enters on every request in every log mode; only req-less callers (boot, CLI, cron) still read the worker-global. The router's classification defers to isaac's pre-port-strip stamp, so direct requests no longer rewrite the worker-global, and isaac's port-less scheme chain matches the router's (X-Forwarded-Proto, then the proxy scheme, then the bundle's own). On earlier versions, `server.proxy.requireForwardedHeaders` closes the port-less-Host path only — it never gated `X-Forwarded-Host`, so a client with direct reach to a bundle could still supply the host; the complete interim there is a fronting proxy that overrides both headers before the bundle. Pickup: a bundle restart and a re-bake — the client bundle's bytes change although its behaviour does not. (#B502)
+
 ## 0.6.27 - 2026-09-05
 ### Changed
 * Two controller events fire less often now that the fluent `{onComplete}` handles deliver per call (#B475). `query#complete` is emitted on the controller only when nothing consumed the outcome — no callback and no `.onComplete()` — one tick after settlement; a fluent query that registers a callback no longer emits it (no in-tree or documented listener existed). `'uploaded'` is no longer emitted for the fluent `store(target).onComplete(cb)` form (never a documented `@fires`; the callback form never emitted it). Also, `query()` in callback form now returns `undefined` on every path instead of an unusable per-transport handle object on success, and an explicit `null` callback selects the fluent form instead of throwing `callback is not a function` at delivery time.

package/README.md

@@ -66,33 +66,46 @@ open https://localhost:3100
 
 > **npm 12+** blocks install scripts by default, and gina's post-install bootstraps `~/.gina` and the framework dependencies. Install with `npm install -g gina@latest --allow-scripts=gina`, or allow it once for all global installs with `npm config set allow-scripts=gina --location=user`. (Not needed on npm ≤ 11.)
 
-## What's in 0.6.27
+## What's in 0.6.28
 
-> **Restart your bundles *and* rebuild them.** Two of the fixes are
-> browser-bundled (the FormValidator autofill pair), so `gina.min.js` and
-> `gina.min.css` both changed — `gina bundle:restart` alone leaves the old
-> client running. Rebuild each consuming bundle, then restart.
+> **Restart your bundles *and* rebuild them.** Three of the fixes are
+> browser-bundled — both client-boot fixes and the proxy-context change — so
+> `gina.min.js` changed and `gina bundle:restart` alone leaves the old client
+> running. Rebuild each consuming bundle, then restart.
 
-> **No settings reset.** `0.6.27` is a patch — the `shortVersion` stays `0.6`,
+> **No settings reset.** `0.6.28` is a patch — the `shortVersion` stays `0.6`,
 > so your `~/.gina/0.6/settings.json` is untouched. (`0.6.0` was the reset.)
 
-**The completion-handle release** — most of it is one shape found in three
-places: a completion handle that settled on a process-wide or instance-wide
-event, so two calls in flight at once delivered each other's results, or
-nothing at all. `lib.archiver` and the controller's fluent `.onComplete()`
-both now settle per call. Alongside them, FormValidator learns to see a
-browser autofill, and the Inspector stops serving one request's data to
-every later one. Full detail in [CHANGELOG.md](./CHANGELOG.md).
-
-- **Security — Inspector payloads no longer leak across requests through the compiled-template cache (#B464).** With `server.cache.enable` true and the Inspector block injected (automatic in dev; in production only when a controller calls `self.render(data, true)`), the `window.__ginaData` script was baked into the layout *before* swig compiled it, so the per-view compiled template and the persisted `.gina-layout-cache` file carried the **first** request's page data — the controller's data, the session card, the environment — and served it to every later request of that view, to other views compiled after it, and to every later process until the file was removed. The popin hidden inputs were a second pre-compile carrier, and `/_gina/reveal` plus the Inspector stream froze with them. The compiled layout now carries only an HTML-comment marker: both cache paths build the payload *after* the template executes and splice this request's script, so a cache hit refreshes the Inspector sinks too. A stale layout-cache file written by an earlier release is healed in place on the next compile — deleting `.gina-layout-cache` is optional, never required.
-- **Changed — two controller events fire less often (#B475).** Now that the fluent `{onComplete}` handles deliver per call, `query#complete` is emitted on the controller only when nothing consumed the outcome — no callback and no `.onComplete()` — one tick after settlement; a fluent query that registers a callback no longer emits it. `'uploaded'` is no longer emitted for the fluent `store(target).onComplete(cb)` form. Neither had a documented listener. Also `query()` in callback form now returns `undefined` on every path instead of an unusable per-transport handle, and an explicit `null` callback selects the fluent form instead of throwing at delivery time.
-- **Fixed — `lib.archiver` calls no longer interfere with each other (#B473).** Every `compress()` and `decompress()` completion used to be signalled by emitting one fixed event name on the process-wide singleton, so two overlapping calls — two queue consumers, or a request handler beside a worker — both received whichever run finished first: the second caller was released early with the first run's archive path, and its own archive was left at 0 bytes. The array form also kept its output stream in an implicit global, so finishing one run closed another's. Each call now settles exactly once for its own listeners, and a listener attached after the run settled is still delivered. Errors on the streams the library opens itself now reach the caller too: an unreadable input used to either crash the process or hang the run forever, leaving a corrupt partial archive on disk, depending on timing.
-- **Fixed — the directory form of `compress()` no longer drops the first entry (#B474).** Its top-level walk seeded the work list from index 1 — the author evidently expected `.` to come first, which node's `readdir` never returns — so a directory holding a single file archived to an empty zip, and every directory-form archive silently lacked one file. The in-tree `project:backup` command uses the array form and was never affected; only direct callers of the directory form are.
-- **Fixed — the single-file form of `compress()` writes a real zip, and `decompress()` reads every form back (#B476).** It used to pipe the file through a gzip codec and write the result under the `.zip` name, which `unzip` and `decompress()` both rejected, and `method: 'br'` or `'deflate'` were accepted by the option validator and silently produced that same gzip. The archive keeps its path and holds one entry named by the basename; **the bytes change from a gzip member to a DEFLATE zip, so anything that gunzipped the output directly must now read it as a zip.** `method` is validated against `gzip` alone again, so `br` and `deflate` throw synchronously as they did before a refactor silenced them. The same branch also skipped any input whose path carried a dot-prefixed segment — a `.env`, or a file under `~/.config/` — reporting success with the *input* path as the archive, leaving an empty zip on disk and leaking the descriptors it had opened.
-- **Fixed — fluent `.onComplete()` handles deliver to their own call (#B475).** `self.query()` and `self.store()` both registered the application callback on the controller instance's shared EventEmitter. `store(target).onComplete(cb)` used `self.on('uploaded', cb)` and never removed it, so a second `store()` on the same controller re-invoked every earlier callback with the later result; `query(options, data).onComplete(cb)` cleared every `query#complete` listener before registering its own, so a concurrent fluent query evicted the first — its callback never fired, the survivor could receive the other call's payload, and the evicted response was emitted to nobody, on both transports, with no log line. The synchronous failure paths of `query()` also returned `emit()`'s boolean instead of the handle, so chaining `.onComplete` threw `TypeError` and the error was lost. `query()` now mints one delivery channel per call and returns the handle on every path; the delivered shapes are unchanged.
-- **Fixed — a `query()` issued while rendering from another required controller now settles (#B479).** The guard that refuses `self.query()` once a second render has been entered on the request — the state `requireController` produces, because the required controller shares the caller's options object — returned the literal `false` and delivered nothing: the callback form never fired and the fluent chain threw `TypeError` on the boolean. The refusal now settles like every other synchronous failure, with an `Error` whose `code` is `NESTED_RENDER`, and the upstream is still never contacted.
-- **Fixed — FormValidator reacts to a browser or password-manager autofill (#B478).** A fill lands without any keystroke, and on Chrome without an `input` or `change` event until a later gesture, so the live check never re-ran: the submit control kept the gated look it was given at bind time on a form the user could see was complete, and an autofilled invalid value showed no error. The default stylesheet now gives every autofilled control a 1 ms keyframe, and the validator routes the resulting `animationstart` into the field's own live check. A value the browser still withholds from script no longer counts against the gate and renders no false required error; the submit-time check is unchanged, so a value still withheld at click time is refused and never posted empty.
-- **Fixed — FormValidator tells the truth about an autofilled field it refuses at submit time (#B341).** Such a field is visibly filled yet reads empty to script, so the submit-time check correctly refuses to post it — but the message it rendered was the plain required label, naming a problem the user could not see. A new built-in label key `isRequiredAutofill` covers that one case, with the verdict, the `errors` key and the submit gate all unchanged, and the control is marked `data-gina-form-autofill-withheld="true"` as a styling hook. The key is alias-filled from an app-supplied `isRequired` label, so a localized catalog keeps its own wording until it translates the new key itself.
+**The every-request release** — much of it is one shape in several places:
+something that was right *once* and not afterwards. `self.forward()` computed
+the target route and then discarded it. The browser client attached its boot
+listener after the event that would have fired it, so a light page stayed
+half-booted. And a run of HTTP/2 response features — the `rel=preload` header,
+the automatic 103, the Inspector's asset map — were built on the compile path
+only, so the first request of a view carried them and every later one did not.
+Alongside them `self.forward()` learns to relay an upload, five fluent
+`.onComplete()` handles learn to refuse a callback they cannot call, and one
+request's proxy context can no longer steer the absolute URLs another request
+builds. Full detail in [CHANGELOG.md](./CHANGELOG.md).
+
+- **Security — one request's proxy context no longer steers another's absolute URLs (#B502).** After a single request carrying a port-less `Host` — an orchestrator probe, a sibling-bundle call, any client sending `Host: name` with no port — reached a worker, every later direct request on that worker built `getRoute().toUrl()` from a worker-global: on an HTTP/1.1 bundle the port vanished, and on an HTTP/2 + HTTPS bundle the *last port-less client's host* was emitted verbatim. Because that host is chosen by the client, it is a host-header-injection class for application-built links and redirects. `getRoute()` now resolves the proxied classification and the proxy hostname from the request itself through a per-request store, and only req-less callers (boot, CLI, cron) still read the worker-global. On earlier versions `server.proxy.requireForwardedHeaders` closes the port-less-`Host` path **only** — it never gated `X-Forwarded-Host` — so the complete interim there is a fronting proxy that overrides both headers before the bundle.
+- **Added — `self.forward()` relays a `multipart/form-data` request, uploads included (#B489).** It used to hand `req[method]` to `self.query()`, which JSON-encodes its `data` and forces the JSON mime, so a forwarded upload arrived as a JSON object of its text fields and `req.files` never travelled at all. A new `lib/multipart` encoder rebuilds one RFC 7578 body from the parsed text fields — re-flattened to bracket notation, the exact inverse of the parser's nester — and from the staged files read at their staged paths, under a CSPRNG boundary redrawn until it appears in no part. The body is buffered and therefore bounded: by the source bundle's `upload.maxFieldsSize` when the parser stamped a usable cap, else 16 MB, checked before a byte is read — a breach answers 413 naming both numbers. Files forwarded under a method carrying no body answer 400; an unreadable staged part answers 500 naming the path. Staged files are read and never deleted, so your own cleanup still owns them.
+- **Fixed — `self.forward()` forwards to the route it resolves (#B488).** It computed the target route and discarded it, sending the request to the target bundle's webroot alone — or, for a raw host, to the *port number* as the path — with placeholder values taken from the routing declaration (`":id"`) rather than the captured URL parameters, an inverted `project` override, and a credentials read that could throw on a bundle without any. The resolved route URL is now the forwarded path, placeholders come from the request, a string answer is relayed verbatim with `renderTEXT()` instead of being re-encoded as JSON, and an unknown target is answered through `throwError()`.
+- **Fixed — the client no longer stays half-booted on a light page (#B483).** `core.js` attached its `ginaloaded` listener only after the async `routing.json` fetch resolved, while the `core` RequireJS factory — which the loader defers by a 4 ms `nextTick` — is what constructs gina and dispatches that event. Whenever the fetch lost the race the event fired with no listener: `isFrameworkLoaded` never flipped, and the popin, validator and nav boot pollers gave up, so every `data-gina-nav` hop degraded to a full navigation and no form ever bound. Pages registering a `gina.ready()` handler had a second route through the ready scheduler, which is why heavier pages booted. The listener is now attached at parse time, above the `core` module definition, so it precedes the dispatch by construction.
+- **Fixed — the client boots inside a cross-origin iframe (#B486).** `construct()` read `parent.window['gina']` unconditionally to inherit a parent frame's instance; under a cross-origin parent that named-property read throws `SecurityError`, and since `construct()` is `async` the throw became an unobserved rejection — `ginaloaded` was never dispatched and the page stayed silently half-booted, with nothing in the console beyond the rejection. The inheritance is optional and is now attempted inside a try/catch: a same-origin parent still shares its instance, a cross-origin one is skipped and the boot proceeds.
+- **Fixed — the HTTP/2 `link` preload header is sent on every response, not only the first per view (#B495).** With `server.cache.enable: true` a bundle served over HTTP/2 built its `rel=preload` header on the compile path only, and the compiled-template cache-hit path returned before reaching it — so in production the first request of a view carried the hints and every later one carried none, with no 103 to compensate. The header is now assembled once per view, memoised on the cache entry and re-emitted on hits under the same gates (never for XHR, never in dev). Two consequences worth knowing: with the template cache on, an XHR request now computes the preload map too, so a page first loaded by fetch no longer leaves it empty; and an empty `link` header is no longer sent when nothing qualifies.
+- **Fixed — the automatic 103 Early Hints response actually fires (#B496).** `render()` read the accumulated `h2Links` prefix and called `setEarlyHints()` when truthy — but the only writers of that prefix run in `getNodeRes()`, which every one of the five render delegates reaches *after* `render()` has dispatched to it. The read therefore always saw the empty string the router seeds, and the hint was skipped on every request since the feature was added. It was never a regression: the introducing commit already dispatched below the read. The prefix is now computed before the dispatch from the view's declared stylesheets and scripts, and the router's seed is restored immediately afterwards so the final 200 `Link` header is byte-identical, verified on a live HTTP/2 production boot against a same-boot control. No hint for XHR, in dev, or for SRI'd assets — a preload hint carries no integrity metadata. `self.setEarlyHints()` was unaffected and has always worked.
+- **Fixed — the Inspector View tab shows the preload assets map again (#B490, #B481).** Since `0.6.25` it rendered the literal `${assets}`: the layout-level substitution that swapped the placeholder for the real `getAssets()` map stopped matching once inline-script brace escaping landed (#B463), and `0.6.27` then moved the Inspector payload after template execution (#B464), so the placeholder rode `user.view.assets` — and the XHR hidden view input — verbatim for three releases. The payload now reads the per-template parsed assets map at splice time on both cache paths, and under HTTP/1.1, where the preload block never runs, `view.assets` is simply absent instead of a placeholder.
+- **Fixed — a custom error page carries its preloads and its external plugins (#B497).** Rendered over HTTP/2, a custom error page now carries the config-declared CSS/JS `rel=preload` entries in its final `link` header and — when scripts are not in defer mode, the only mode in which the framework injects external plugins into the head — the scripts declared `isExternalPlugin: true`, like every other page. The custom-error render built its options with a *copy* of the template config, so what the framework accumulated while resolving the error page's assets never reached the header or the head it read; error pages had never carried either since both existed. The render now shares the request's template object and re-seeds its per-response accumulators first, so an error struck after the failing route's assets were resolved does not double the preload entries or the plugin tags.
+- **Fixed — a retried HTTP/1 request goes out with its body (#B494).** The handler deleted `options.queryData` after writing the first attempt, and the retry re-entered with the same options object, so the second attempt was sent with `content-length: 0` and an empty body — and whatever the upstream made of that was reported back as the result. It affected any body, but only with `retryUnsafe` enabled, since the methods that auto-retry by default carry none. The body is now stashed on the options the way the HTTP/2 handler already did, and restored on re-entry.
+- **Fixed — `self.store()` no longer drops the outcome of a `null` callback (#B480).** The fluent guard tested only for `undefined`, so `store(target, files, null)` fell into the callback branch, whose arms emitted to an event with zero in-tree listeners: the upload ran and nothing was told. A truthy non-function given to `.onComplete()` threw from inside an fs callback — an uncaughtException on every path but one. The guard now mints the fluent handle for any non-function `cb`, `.onComplete()` throws synchronously at the caller, and the seven unreachable emitter arms are gone with their undocumented event. Behaviour change: `store(target, files, null)` returns the handle and starts the upload when `.onComplete()` is chained, exactly like an omitted `cb`.
+- **Fixed — `self.query()`'s fluent `.onComplete()` rejects a non-function at registration (#B485).** It minted a deliverer for whatever it was given, so `.onComplete(null)` registered silently and the `TypeError` fired only at settle — inside the delivery wrapper's own try/catch, which turned it into a 500 blaming the application callback for an exception it never had. It now throws at the caller's line, mirroring `self.store()`. Anything relying on the old behaviour was relying on a 500.
+- **Fixed — `run()` refuses a callback it cannot call (#B491).** The framework global (also `gna.run`) now throws a `TypeError` at the caller's line when its fluent `.onComplete()` or its positional callback is given anything but a function. A wrong argument used to be accepted silently: the command ran to completion, the resulting `callback is not a function` was caught by the command's close handler and only logged, and the caller's completion never arrived. `null`/`undefined` positionally still mean "use `.onComplete()`".
+- **Fixed — `Shell::run()` refuses one too, on both of its handles (#B491).** `lib/shell` wraps the callback inside its own listener on `.onComplete()` *and* `.onData()`, so either given a non-function was accepted silently and the failure surfaced only as a logged line while the caller's delivery never arrived. Both now throw at the caller's line, with `null` reported as `null` rather than `object`.
+- **Fixed — the dead `onComplete` on entity method objects is gone (#B491).** A leftover of the pre-Promise design, when a method returned the entity function itself with the handle hanging off it. Its own comment claimed it would be overridden; nothing ever wrote to it, so a callback registered on the *method* rather than on the *call* was swallowed and never fired. Disclosed behaviour change: `entity.method.onComplete(cb)` — the wrong form, silently dead in every release that had it — now throws `is not a function` at the call site. The correct `entity.method(args).onComplete(cb)` is untouched.
+- **Fixed — `{% extends %}` extraction stops at its own directive (#B484).** Both quantifiers were greedy, so a one-line directive followed by another quoted tag ran the directive match to the last closing delimiter on the line and the quoted-path match to the last quote, producing a layout path that matched nothing — the layout-cache re-point then silently never happened and the page extended the raw layout.
+- **Fixed — a layout named ahead of its `{% extends %}` directive no longer breaks the re-point (#B482).** The rewrite that sends the directive at its assembled cache copy searched the whole template for the layout's bare filename and took the first occurrence anywhere, so a mention in a leading comment was rewritten while the directive kept the raw path. The substitution is now spliced inside the matched directive, leaving a later legitimate mention untouched.
+- **Fixed — `POST /_gina/maintenance` no longer fails open on an invalid `ttlSeconds` (#B498).** The handler validated `enable` but guarded `ttlSeconds` with a single positive condition, so a value that was not an integer from 1 to 86400 — a 25-hour window, a float, a numeric string — was silently ignored and the flip applied with **no timer at all**: the caller asked for a bounded maintenance window and got an unbounded one, with `until: null` as the only tell. Both engines now answer 400, naming the bound and the configuration alternative for a window that must outlive a day. Refused rather than clamped on purpose — a shorter-than-requested window reopens a site mid-deploy, so there is no safe direction to round toward.
 
 ## Documentation
 

package/ROADMAP.md

@@ -79,6 +79,7 @@ This roadmap covers planned features, architectural improvements, new connectors
 | **Q4 2026** | `0.6.24` ✅ | **Fixed**: Couchbase `bulkInsert` no longer returns `undefined` when its own prologue throws — the outer `try` wraps the method body, so a synchronous failure (an unresolvable connection, or either `rec` validation) was caught, logged and swallowed, and the method fell off the end: the `await` form resolved with `undefined`, so a caller treating "did not throw" as success recorded an insert that never happened, and `.onComplete(cb)` threw a `TypeError` at the call site. The promise, its one-shot resolver and the `.onComplete` shim are now built before the `try`, so the outer catch settles the call. A fire-and-forget call now surfaces an `unhandledRejection` where it previously failed silently, and the fix moves what `bulkInsert` RETURNS, not what its promise RESOLVES WITH — a rows-less success still resolves `null`. **Fixed**: a Couchbase entity that fails to register now names itself, its source file, the method being attached and the underlying cause, instead of emitting a bare stack that left a partially-built entity and a missing method surfacing arbitrarily far from the cause; registration stays non-fatal. **Fixed**: the reconnect classifier no longer throws under every supported SDK — `err instanceof couchbase.Error` raised a `TypeError` because no supported couchnode exports a bare `Error` class, and since that operand is evaluated first the message arm was unreachable too, so the classifier could not classify by any route; each `instanceof` is now guarded on the class existing (deliberately a guard, not an activation — on the default `isaac` engine the listener is never dispatched at all). Restart your bundles — the browser bundle is unchanged, so no rebuild is needed. |
 | **Q4 2026** | `0.6.26` ✅ | **Fixed**: the error-path and orphan-reclaim release. An error response no longer crashes when the rendered payload carries a non-numeric top-level `status` — a page whose own vocabulary includes a field named `status` (say `{status: "draft"}` rendered alongside an error) had that value stamped straight into the HTTP response, which threw `ERR_HTTP_INVALID_STATUS_CODE` and replaced the intended error page with an unhandled 500, i.e. it fired only on the error path, exactly when the error page was needed; every status the error path resolves is now validated against node's own rule (an integer from 100 to 999) and degrades to a 500 error page when it does not qualify, while a numeric status still sets the HTTP status exactly as documented. **Fixed**: error responses now carry the content-type they declare — two branches of the error path, the Internet Explorer override and the branch taken when a request arrives with no `user-agent` header at all (the common shape for machine callers), passed the header NAME as node's status-message argument instead of a headers object, so node read the MIME string character by character: over HTTP/1.1 the response came back with roughly ten to thirty junk headers named `0`, `1`, `2`…, a reason phrase reading `content-type`, and no content-type at all, and over HTTP/2 the headers were dropped entirely — nothing threw, so the malformed response was completely silent. Both branches now pass a headers object, and the plain-text branch declares the bundle encoding as its charset, which is user-visible wherever error copy is not plain ASCII: the body is JSON written as UTF-8, and a charset-less `text/plain` invites the client to guess a single-byte encoding, rendering accented characters and non-Latin scripts as mojibake. **Fixed**: staged multipart upload parts stranded by a previous process are now reclaimed at boot — the `upload.autoTmpCleanupTimeout` deletion timer is per-upload and in-process, so a restart stranded every staged part it was holding and a part that never reached `self.store()` had no reclaim path at all; when the timer is armed, server init now sweeps each configured landing directory for staged-shaped `.part` files older than the configured timeout, floored at one hour so an in-flight upload from a sibling live process on a shared staging directory is never touched, and the sweep is deliberately conservative (exact server-generated name shape only, regular files only, symlinks never followed, non-recursive). A disabled timer — the shipped default — still arms no sweep. **Fixed**: job records stranded by a process death are now reclaimed — the deferred function of an async job lives only in its creating process, so a record left `running` by a crash or an unclean restart could never settle: its `expiresAt` stayed null forever, the TTL sweep's own guard excluded it, listings reported phantom running work and the documented polling pattern never terminated; the sweep is now preceded by an orphan-reclaim pass on durable stores marking a non-terminal record older than `jobs.orphanTimeout` (seconds, default 86400, `0` or `false` disables, floored at 60) as `failed` with error name `JobOrphanedError`, after which normal `ttl` retention removes it on schedule — the built-in memory store is exempt and no completion webhook fires for a reclaim. Restart your bundles — the browser bundle is unchanged, so no rebuild is needed. |
 | **Q4 2026** | `0.6.27` ✅ | **Security**: Inspector payloads no longer leak across requests through the compiled-template cache — with `server.cache.enable` on and the Inspector block injected, automatic in dev and in production only when a controller calls `self.render(data, true)`, the `window.__ginaData` script was baked into the layout before swig compiled it, so the per-view compiled template and the persisted `.gina-layout-cache` file carried the FIRST request's page data — the controller's data, the session card, the environment — to every later request of that view, to other views compiled after it, and to every later process until the file was removed; the popin hidden inputs were a second pre-compile carrier and `/_gina/reveal` froze with them; the compiled layout now carries only an HTML-comment marker and both cache paths build the payload after the template executes, so a cache hit refreshes the Inspector sinks too, and a stale layout-cache file from an earlier release is healed in place on the next compile. **Changed**: two controller events fire less often now that the fluent `{onComplete}` handles deliver per call — `query#complete` is emitted on the controller only when nothing consumed the outcome, no callback and no `.onComplete()`, one tick after settlement, and `'uploaded'` is no longer emitted for the fluent `store(target).onComplete(cb)` form; neither had a documented listener; `query()` in callback form now returns `undefined` on every path instead of an unusable per-transport handle, and an explicit `null` callback selects the fluent form instead of throwing at delivery time. **Fixed**: the completion-handle release. `lib.archiver` settles each `compress()` and `decompress()` call on its own completion channel — every completion used to be signalled by emitting one fixed event name on the process-wide singleton, so two overlapping calls in one process, two queue consumers or a request handler beside a worker, both received whichever run finished first: the second caller was released early with the first run's archive path and its own archive was left at 0 bytes, and the array form kept its output stream in an implicit global so finishing one run closed another's; errors on the streams the library opens itself now reach the caller too, where an unreadable input used to either crash the process or hang the run forever, leaving a corrupt partial archive on disk. **Fixed**: the directory form of `compress()` no longer drops the first entry of the top-level directory — its walk seeded the work list from index 1, the author evidently expecting `.` first, which node's `readdir` never returns, so a directory holding a single file archived to an empty zip; the in-tree `project:backup` command uses the array form and was never affected. **Fixed**: the single-file form of `compress()` writes a real one-entry zip and `decompress()` reads every form back — it used to pipe the file through a gzip codec and write the result under the `.zip` name, which `unzip` and `decompress()` both rejected, while `method: 'br'` and `'deflate'` were accepted by the option validator and silently produced that same gzip; the bytes change from a gzip member to a DEFLATE zip, so anything that gunzipped the output directly must now read it as a zip, `method` validates against `gzip` alone again, and an input whose path carries a dot-prefixed segment, a `.env` or anything under `~/.config/`, is archived instead of being skipped with a false success, an empty zip and two leaked descriptors. **Fixed**: the fluent `.onComplete()` handles of `self.query()` and `self.store()` deliver to their own call — both registered the application callback on the controller instance's shared EventEmitter, so a second `store()` on the same controller re-invoked every earlier callback with the later result, and a concurrent fluent query evicted the first one: its callback never fired, the survivor could receive the other call's payload and the evicted response was emitted to nobody, on both transports with no log line; the synchronous failure paths of `query()` also returned `emit()`'s boolean instead of the handle, so chaining `.onComplete` threw `TypeError` and the error was lost; `query()` now mints one delivery channel per call and returns the handle on every path, with the delivered shapes unchanged. **Fixed**: a `self.query()` issued while the controller is rendering from another required controller now settles — the guard that refuses it once a second render has been entered, the state `requireController` produces because the required controller shares the caller's options object, returned the literal `false` and delivered nothing, so the callback form never fired and the fluent chain threw `TypeError` on the boolean; the refusal now rides the per-call channel as a coded `NESTED_RENDER` error and the upstream is still never contacted. **Fixed**: FormValidator reacts to a browser or password-manager autofill — a fill lands without any keystroke, and on Chrome without an `input` or `change` event until a later gesture, so the live check never re-ran: the submit control kept the gated look it was given at bind time on a form the user could see was complete, and an autofilled invalid value showed no error; the default stylesheet now gives every autofilled control a 1ms keyframe and the validator routes the resulting `animationstart` into the field's own live check, while a value the browser still withholds from script no longer counts against the gate and renders no false required error. **Fixed**: FormValidator tells the truth about a field the browser autofilled but still withholds from script at submit time — visibly filled yet reading empty to script, it is correctly refused, but the message rendered was the plain required label, naming a problem the user could not see; a new built-in label key `isRequiredAutofill` covers that one case with the verdict, the `errors` key and the submit gate all unchanged, the control is marked `data-gina-form-autofill-withheld` as a styling hook, and the key is alias-filled from an app-supplied `isRequired` label so a localized catalog keeps its own wording until it translates the new key. Restart **and** rebuild your bundles — the browser bundle changed (the two FormValidator autofill fixes ride `gina.min.js` and `gina.min.css`). |
+| **Q4 2026** | `0.6.28` ✅ | **Security**: absolute URLs built by an application-level `getRoute().toUrl()` no longer inherit another request's proxy context — after a single request carrying a port-less `Host` (an orchestrator probe, a sibling-bundle call) reached a worker, every later direct request on it built URLs from a worker-global, dropping the port on HTTP/1.1 and emitting the *last port-less client's host* verbatim on HTTP/2 + HTTPS, which is a host-header-injection class for application-built links and redirects; the proxied classification and proxy hostname now resolve from the request itself, and on earlier versions `server.proxy.requireForwardedHeaders` closes the port-less-`Host` path only. **Added**: `self.forward()` relays a `multipart/form-data` request, uploads included, through a new RFC 7578 encoder and a raw-body pass-through, bounded by the source bundle's upload cap (413 on breach, 400 for a body-less method). **Fixed**: `self.forward()` forwards to the route it resolves instead of the target bundle's webroot alone; the browser client no longer stays half-booted on a light page or inside a cross-origin iframe; the HTTP/2 `rel=preload` header is sent on every response rather than only the first per view; the automatic 103 Early Hints response fires at all; the Inspector View tab shows its assets map again; a custom error page carries its preloads and its external plugins; a retried HTTP/1 request goes out with its body; the fluent `.onComplete()` handles of `query()`, `store()`, `run()` and `Shell::run()` refuse a callback they cannot call, and the dead one on entity method objects is removed; `{% extends %}` extraction stops at its own directive and tolerates the layout being named ahead of it; `POST /_gina/maintenance` refuses an invalid `ttlSeconds` instead of arming an unbounded window. Restart your bundles **and rebuild them** — three of the fixes are browser-bundled. |
 | **Q1 2027** | `0.6.x` | HTTP/2 priorities (blocked on Node scheduler hooks) · Beemaster admin + visual translation editor |
 | **2027** | `0.7.0` | Performance — remaining measure-gated candidates: multipart & WebSocket fast paths, render/log cleanups, SIMD scanner (the render-path deep-clone & id-mint reduction shipped early in `0.6.2` with a measured 4.4× render-throughput gain; the profiling baseline itself also shipped in `0.6.2`) |
 | **2027** | `0.8.0` | Financial-messaging foundations — XML request/response handling · pluggable message-schema validation · IBAN/BIC validation rules · money & ISO 4217 minor-unit utilities · idempotency keys |

package/framework/v0.6.28/VERSION

@@ -0,0 +1 @@
+0.6.28